Recent mobile communication devices, such as e.g. cellular phones, smartphones, PDAs, and tablets, are often equipped with various advanced technologies for handling and using sensitive information. An example of such technologies is the combination of NFC and Secure Elements, which may e.g. be used in connection with various payment applications which involve use of sensitive information, such as credit card information, bank account numbers, passwords etc. This sensitive information has to be protected but at the same time the applications need to be able to access the relevant secure functions in order to serve their intended purpose.
Some mobile device operating systems, such as the Android-based operating systems, include functions for authenticating applications. This may be done by determining whether the application is genuine, i.e. by validating that the application has been signed by the application provider. However, the number of secure functions which an application actually needs to access may differ in dependence on its specific purpose. Accordingly, simply giving an application access to all or none of the secure functions may constitute a security risk in cases where an application is allowed to access more secure functions than it actually needs. Furthermore, when a new application provider enters the market, authentication of applications provided by the new provider will not be possible until the mobile operating system has been updated to include the corresponding certificate.
There may accordingly be a need for an improved way of controlling application access to secure functions of mobile devices without the drawbacks described above.